Chapter 11: Its a

Network

Introduction to Networking

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Chapter 11
11.0 Introduction
11.1 Create and Grow
11.2 Keeping the Network Safe
11.3 Basic Network Performance
11.4 Managing IOS Configuration Files
11.5 Integrated Routing Services
11.6 Summary

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Chapter 11: Objectives

Upon completion of this chapter, you will be able to:
Identify the devices and protocols used in a small network.
Explain how a small network serves as the basis of larger
networks.
Describe the need for basic security measures on network devices.
Identify security vulnerabilities and general mitigation techniques.
Configure network devices with device hardening features to
mitigate security threats.
Use the output of ping and tracert commands to establish
relative network performance.
Use basic show commands to verify the configuration and status of
a device interface.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Chapter 11: Objectives (Cont.)

Use the basic host and IOS commands to acquire information
about the devices in a network.
Explain the file systems on Routers and Switches.
Apply the commands to back up and restore an IOS configuration
file.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

11.1 Create and Grow

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Devices in a Small Network

Small Network Topologies

Typical Small Network Topology

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Devices in a Small Network

Device Selection for a Small Network

Factors to be considered when selecting intermediate devices.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Devices in a Small Network

IP Addressing for a Small Network

IP addressing scheme should be planned, documented and
maintained based on the type of devices receiving the address.
Examples of devices that will be part of the IP design:
End devices for users

Servers and peripherals

Hosts that are accessible from the Internet
Intermediary devices

Planned IP schemes help the administrator:

Presentation_ID

Track devices and troubleshoot

Control access to resources

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Devices in a Small Network

Redundancy in a Small Network

Redundancy helps to
eliminate single points
of failure.
Improves the
reliability of the
network.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

Devices in a Small Network

Design Considerations for a Small Network

The following should be
included in the network
design:
Secure file and mail
servers in a
centralized location.
Protect the location
by physical and
logical security
measures.
Create redundancy
in the server farm.
Configure redundant
paths to the servers.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

10

Protocols in a Small Network

Common Applications in a Small Network

Network-Aware Applications Software programs that are used to
communicate over the network.
Application Layer Services Programs that interface with the
network and prepare the data for transfer.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

11

Protocols in a Small Network

Common Protocols in a Small Network

Network Protocols
Define:
Processes on either
end of a
communication
session.
Types of messages.
Syntax of the
messages.
Meaning of
informational fields.
How messages are
sent and the
expected response.
Interaction with the
next lower layer.
Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

12

Protocols in a Small Network

Real-Time Applications for a Small Network

Real-time applications require planning and dedicated services to
ensure priority delivery of voice and video traffic.
Infrastructure Needs to be evaluated to ensure it will support
proposed real time applications.
VoIP Is implemented in organizations that still use traditional
telephones.
IP telephony The IP phone itself performs voice-to-IP
conversion.
Real-time Video Protocols Use Time Transport Protocol (RTP)
and Real-Time Transport Control Protocol (RTCP).

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

13

Growing to Larger Networks

Scaling a Small Network

Important considerations when growing to a larger network:
Documentation Physical and logical topology.
Device inventory List of devices that use or comprise the network.

Budget Itemized IT expense items, including the amount of money

allocated to equipment purchase for that fiscal year.
Traffic Analysis Protocols, applications, and services and their
respective traffic requirements should be documented.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

14

Growing to Larger Networks

Protocol Analysis of a Small Network

Information gathered by protocol analysis can be used to make
decisions on how to manage traffic more efficiently.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

15

Growing to Larger Networks

Evolving Protocol Requirements

Network administrator
can obtain IT
snapshots of
employee application
utilization.
Snapshots track
network utilization
and traffic flow
requirements.
Snapshots help
inform network
modifications needed.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

16

11.2 Keeping the Network

Safe

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

17

Network Device Security Measures

Threats to Network Security

Categories of Threats to Network Security

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

18

Network Device Security Measures

Physical Security
Four classes of physical threats are:
Hardware threats Physical damage to servers, routers,
switches, cabling plant, and workstations
Environmental threats Temperature extremes (too hot or too
cold) or humidity extremes (too wet or too dry)
Electrical threats Voltage spikes, insufficient supply voltage
(brownouts), unconditioned power (noise), and total power loss
Maintenance threats Poor handling of key electrical
components (electrostatic discharge), lack of critical spare parts,
poor cabling, and poor labeling

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

19

Network Device Security Measures

Types of Security Vulnerabilities

Vulnerabilities - Technology

Types of Security
Weaknesses:
Technological
Configuration

Security policy

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

20

Vulnerabilities and Network Attacks

Viruses, Worms and Trojan Horses

Virus Malicious software that is attached to another program to
execute a particular unwanted function on a workstation.
Trojan horse An entire application written to look like something
else, when in fact it is an attack tool.
Worms Worms are self-contained programs that attack a system
and try to exploit a specific vulnerability in the target. The worm
copies its program from the attacking host to the newly exploited
system to begin the cycle again.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

21

Vulnerabilities and Network Attacks

Reconnaissance Attacks

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

22

Vulnerabilities and Network Attacks

Access Attacks

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

23

Vulnerabilities and Network Attacks

Access Attacks (Cont.)

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

24

Vulnerabilities and Network Attacks

Denial of Service Attacks (DoS)

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

25

Mitigating Network Attacks

Backup, Upgrade, Update, and Patch

Antivirus software can detect most viruses and many Trojan horse
applications and prevent them from spreading in the network.
Keep current with
the latest versions
of antivirus
software.
Install updated
security patches.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

26

Mitigating Network Attacks

Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting (AAA, or triple A)
Authentication Users and administrators must prove their identity.
Authentication can be established using username and password
combinations, challenge and response questions, token cards, and
other methods.
Authorization Determines which resources the user can access
and the operations that the user is allowed to perform.
Accounting Records what the user accessed, the amount of time
the resource is accessed, and any changes made.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

27

Mitigating Network Attacks

Firewalls
A Firewall resides
between two or more
networks. It controls
traffic and helps prevent
unauthorized access.

Firewalls

Methods used are:

Packet Filtering
Application Filtering

URL Filtering
Stateful Packet
Inspection (SPI)
Incoming packets must
be legitimate
responses to requests
from internal hosts.
Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

28

Mitigating Network Attacks

Endpoint Security
Common endpoints are
laptops, desktops,
servers, smart phones,
and tablets.
Employees must follow
the companies
documented security
policies to secure their
devices.
Policies often include
the use of anti-virus
software and host
intrusion prevention.

Presentation_ID

Common Endpoint Devices

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

29

Securing Devices

Introduction to Securing Devices

Part of network security is securing devices, including end devices
and intermediate devices.
Default usernames and passwords should be changed
immediately.
Access to system resources should be restricted to only the
individuals that are authorized to use those resources.
Any unnecessary services and applications should be turned off
and uninstalled, when possible.
Update with security patches as they become available.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

30

Securing Devices

Passwords
Weak and Strong Passwords

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

31

Securing Devices

Basic Security Practices

Encrypt passwords.
Require minimum
length passwords.
Block brute force
attacks.
Use Banner
Message.
Set EXEC timeout.

Presentation_ID

Securing Devices

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

32

Securing Devices

Enable SSH

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

33

11.3 Basic Network

Performance

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

34

Ping

Interpreting ICMP Messages

! indicates
receipt of an
ICMP echo reply
message
. indicates a
time expired
while waiting for
an ICMP echo
reply message
U an ICMP
unreachable
message was
received

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

35

Ping

Leveraging Extended Ping

The Cisco IOS offers an "extended" mode of the ping command:
R2# ping
Protocol [ip]:
Target IP address: 192.168.10.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 10.1.1.1
Type of service [0]:

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

36

Ping

Network Baseline
Baseline with ping

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

37

Ping

Network Baseline (Cont.)

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

38

Tracert

Interpreting Tracert Messages

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

39

Show Commands

Common Show Commands Revisited

The status of nearly every process or function of the router can be
displayed using a show command.
Frequently used show commands:
show running-config
show interfaces
show arp
show ip route
show protocols
show version

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

40

Show Commands

Viewing Router Settings With Show Version

Cisco IOS Version

System Bootstrap
Cisco IOS Image
CPU and RAM
Number and Type of
Physical Interfaces
Amount of NVRAM
Amount of Flash
Configuration Register

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

41

Show Commands

Viewing Switch Settings With Show Version

show version Command

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

42

Host and IOS Commands

ipconfig Command Options

ipconfig Displays
ip address, subnet
mask, default gateway.
ipconfig /all
Also displays MAC
address.
ipconfig
/displaydns
Displays all cached dns
entries in a Windows
system.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

43

Host and IOS Commands

arp Command Options

arp Command Options

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

44

Host and IOS Commands

show cdp neighbors Command Options

show cdp neighbors command provides information about each
directly connected CDP neighbor device.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

45

Host and IOS Commands

Using show ip interface brief Command

show ip interface brief command-used to verify the status
of all network interfaces on a router or a switch.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

46

11.4 Managing IOS

Configuration Files

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

47

Router and Switch File Systems

Router File Systems

show file systems command Lists all of the available file
systems on a Cisco 1941 route.

The asterisk (*) indicates this is the current default file system.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

48

Router and Switch File Systems

Switch File Systems

show file systems command Lists all of the available file
systems on a Catalyst 2960 switch.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

49

Backup and Restore Configuration Files

Backup and Restore Using Text Files

Saving to a Text File in Tera Term

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

50

Backup and Restore Configuration Files

Backup and Restore Using TFTP

Configuration files can be stored on a Trivial File Transfer Protocol
(TFTP) server.

copy running-config tftp Save running configuration to a tftp

server.
copy startup-config tftp Save startup configuration to a tftp
server.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

51

Backup and Restore Configuration Files

Using USB Interfaces on a Cisco Router

USB flash drive must be formatted in a FAT16 format.
Can hold multiple copies of the Cisco IOS and multiple router
configurations.
Allows administrator to easily move configurations from router to
router.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

52

Backup and Restore Configuration Files

Backup and Restore Using USB

Backup to USB Drive

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

53

11.5 Integrated Routing

Services

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

54

Integrated Router

Multi-function Device
Multi-function Device
Incorporates a switch, router, and wireless access point.
Provides routing, switching and wireless connectivity.
Linksys wireless routers, are simple in design and used in home
networks
Cisco Integrated Services Router (ISR) product family offers a wide
range of products, designed for small office to larger networks.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

55

Integrated Router

Wireless Capability
Wireless Mode Most integrated wireless routers support 802.11b,
802.11g and 802.11n.
Service Set Identifier (SSID) Case-sensitive, alpha-numeric name
for your home wireless network.
Wireless Channel RF spectrum can be divided up into channels.
Linksys Wireless Settings

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

56

Integrated Router

Basic Security of Wireless

Change default values
Disable SSID broadcasting
Configure Encryption using WEP or WPA
Wired Equivalency Protocol (WEP) - Uses pre-configured
keys to encrypt and decrypt data. Every wireless device
allowed to access the network must have the same WEP key
entered.
Wi-Fi Protected Access (WPA) Also uses encryption keys
from 64 bits up to 256 bits. New keys are generated each time
a connection is established with the AP; therefore, more
secure.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

57

Integrated Router

Configuring the Integrated Router

Step 1 - Access the router by cabling a computer to one of the routers
LAN Ethernet ports.
Step 2 - The connecting device will automatically obtain IP addressing
information from Integrated Router.
Step 3 - Change default username and password and the default Linksys
IP address for security purposes.
Initial Access to the Router

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

58

Integrated Router

Enabling Wireless
Step 1 - Configure the wireless mode
Step 2 - Configure the SSID
Step 3 - Configure RF channel

Step 4 - Configure any desired security encryption

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

59

Integrated Router

Configure a Wireless Client

The wireless client
configuration settings
must match that of the
wireless router.
SSID
Security Settings
Channel

Wireless client software

can be integrated into the
device operating system
or stand alone,
downloadable, wireless
utility software.

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

60

11.6 Summary

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

61

Chapter 11: Summary

In this chapter, you learned:
Good network design incorporates reliability, scalability, and
availability.
Networks must be secured from viruses, Trojan horses, worms and
network attacks.
The importance of documenting Basic Network Performance.

How to test network connectivity using ping and traceroute.

How to use IOS commands to monitor and view information about
the network and network devices.

How to backup configuration files using TFTP or USB.

Home networks and small business often use integrated routers,
which provide the functions of a switch, router and wireless access
point.
Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

62

Presentation_ID

2008 Cisco Systems, Inc. All rights reserved.

Cisco Confidential

63